Barbacane

Your spec is your gateway.

---

Barbacane is a spec-driven API gateway built in Rust. Point it at an OpenAPI or AsyncAPI spec and it enforces it: routing, request and response validation, authentication, rate limiting, a native WAF, and observability, all declared in the spec you already write. No proprietary config language, no drift between your spec and your infrastructure.

• Spec as config — Your OpenAPI 3.x or AsyncAPI 3.x specification is the single source of truth. The compiler turns it into a sealed .bca artifact; no separate gateway DSL to maintain.
• A full API gateway — Routing, schema-based request and response validation, authentication and authorization, rate limiting, caching, and request/response transformation, all driven by the operation definitions and x-barbacane-* extensions in your spec.
• Native WAF — A built-in ModSecurity/CRS-compatible web application firewall inspects requests and responses inline, in scoring or blocking mode, with per-operation tuning and audit logging. Configured with one x-barbacane-waf block, no sidecar.
• Fast and predictable — Built on Rust, Tokio, and Hyper. No garbage collector, no latency surprises. Route lookup in ~83 ns, full request validation in ~1.2 µs.
• Secure by default — Memory-safe runtime, TLS via Rustls (FIPS-ready via aws-lc-rs), sandboxed WASM plugins, secrets resolved at runtime via env://, file://, and similar references — never baked into artifacts.
• Edge-ready — Stateless data plane instances designed to run close to your users, with a separate control plane handling compilation, artifact distribution, and hot-reload.
• Extensible — 29 official plugins; write your own in any language that compiles to WebAssembly. Plugins run in a sandbox, so a buggy plugin can't take down the gateway.
• Observable — Prometheus metrics, structured JSON logging, and distributed tracing with W3C Trace Context and OTLP export. Per-middleware timing comes for free.

Quick Start

# Clone and build
git clone https://github.com/barbacane-dev/barbacane.git
cd barbacane
cargo build --release

# Initialize a project (scaffolds barbacane.yaml + specs/api.yaml)
./target/release/barbacane init my-api --fetch-plugins
cd my-api

# Start the dev server (compiles, serves, and hot-reloads on save)
../target/release/barbacane dev

For production, use the explicit compile-and-serve workflow:

# Once: generate the key that signs your artifacts, and keep it secret
barbacane key generate --out signing.pk8

BARBACANE_SIGNING_KEY=signing.pk8 barbacane compile -m barbacane.yaml -o api.bca
BARBACANE_TRUSTED_PUBKEY=$(barbacane key public --key signing.pk8) \
  barbacane serve --artifact api.bca --listen 0.0.0.0:8080

The gateway serves only artifacts signed by the key it pins; see artifact signing.

What configuration looks like

The WAF is declared once at the spec root; routing, auth, and rate limits are declared inline on each operation. Request and response bodies are validated against the schemas already in your spec.

# Native WAF for the whole API, tuned per operation as needed.
x-barbacane-waf:
  ruleset: ./waf-rules
  paranoia_level: 1
  mode: blocking
  thresholds: { inbound: 5, outbound: 4 }

paths:
  /orders/{id}:
    get:
      operationId: getOrder
      parameters:
        - name: id
          in: path
          required: true
          schema: { type: string }
      x-barbacane-middlewares:
        - name: oidc-auth
          config:
            issuer_url: "https://auth.example/"
            audience: orders-api
        - name: rate-limit
          config:
            quota: 100
            window: 60
      x-barbacane-dispatch:
        name: http-upstream
        config:
          url: "https://orders.internal.example"
          timeout: 5.0

The compiler validates the spec against each plugin's JSON schema (vacuum:barbacane) and seals everything into a single .bca artifact — including pinned plugin WASM. The data plane runs the artifact; nothing is fetched at request time.

Documentation

Full documentation is available at docs.barbacane.dev.

• Installation: release binaries, container images, crates.io, source
• Migrating from 0.12 to 1.0: what changes, what to do, in which order
• Getting Started — First steps with Barbacane
• Spec Configuration — Configure routing and middleware via x-barbacane-* extensions
• Dispatchers — Route requests to HTTP, Lambda, S3, Kafka, NATS, WebSocket backends
• Middlewares — grouped by concern:
  • Authentication · Authorization · Traffic control
  • Caching · Transformation · Observability
• Control Plane — Manage specs, artifacts, and data planes
• WAF — Native ModSecurity/CRS-compatible web application firewall
• Secrets · Vacuum linting · FIPS
• Extensions reference · CLI reference · Artifact format
• Plugin Development — Build custom WASM plugins
• Development Guide — Setup and contribute

Playground

Try Barbacane locally with the full-featured playground — now in its own repo:

git clone https://github.com/barbacane-dev/playground
cd playground
docker-compose up -d

# Gateway: http://localhost:8080
# Grafana: http://localhost:3000 (admin/admin)

The playground includes a Train Travel API demo with WireMock backend, full observability stack (Prometheus, Loki, Tempo, Grafana), and the control plane. See barbacane-dev/playground for details.

Official Plugins

29 official plugins ship with Barbacane. They're built as WASM modules and run in a sandbox.

Dispatchers — where the request goes

Plugin	Description
http-upstream	Reverse proxy to HTTP/HTTPS backends
mock	Return static responses with {{placeholder}} interpolation
lambda	Invoke AWS Lambda functions
kafka	Publish messages to Kafka
nats	Publish messages to NATS
s3	Proxy requests to AWS S3 / S3-compatible storage with SigV4 signing
ws-upstream	WebSocket transparent proxy with full middleware chain on upgrade
fire-and-forget	Forward request to upstream and return immediate static response

Middlewares — what happens on the way

Concern	Plugins
Authentication	jwt-auth, apikey-auth, basic-auth, oauth2-auth, oidc-auth, ldap-auth
Authorization	acl, opa-authz, cel (CEL policy + policy-driven routing)
Traffic control	rate-limit (sliding window), request-size-limit, ip-restriction, bot-detection, redirect
Caching	cache (response caching)
Transformation	request-transformer, response-transformer, cors, correlation-id
Observability	observability (SLO + detailed logging), http-log

Performance

Benchmark results on Apple M4 (MacBook Air 16GB):

Routing & Validation

Operation	Latency
Route lookup (1000 routes)	~83 ns
Request validation (full)	~1.2 µs
Body validation (JSON)	~458 ns
Router build (500 routes)	~130 µs

WASM Plugin Runtime

Operation	Latency
Module compilation	~210 µs
Instance creation	~17 µs
Middleware chain (1 plugin)	~261 µs
Middleware chain (3 plugins)	~941 µs
Middleware chain (5 plugins)	~1.32 ms
Memory write (1 KB)	~14 ns
Memory write (100 KB)	~1.4 µs

Serialization

Operation	Latency
Request (minimal)	~118 ns
Request (full, 1 KB body)	~921 ns
Response (1 KB body)	~417 ns

Spec Compilation

Operation	Latency
Compile 10 operations	~550 µs
Compile 50 operations	~2.17 ms
Compile 100 operations	~3.72 ms

Run your own benchmarks:

cargo bench --workspace

Project Status

Barbacane is under active development. See ROADMAP.md for the roadmap and CHANGELOG.md for release history.

Contributing

Contributions are welcome! Please read CONTRIBUTING.md for guidelines.

License

Dual-licensed under AGPLv3 and a commercial license. See LICENSING.md for details.

Trademark

Barbacane is a trademark. The software is open source; the brand is not. See TRADEMARKS.md for usage guidelines.